subgraph "Process"
    C1["Sampling based of ratio"]
    C2["Packet Process"]
    C3["Dispatcher"]
    O11["Output1"]
    O12["Domain Skip (optional)"]
    O13["Domain Allow (optional)"]
    O21["Output2"]
    O22["Domain Skip (optional)"]
    O23["Domain Allow (optional)"]
    O31["Output3"]
    O32["Domain Skip (optional)"]
    O33["Domain Allow (optional)"]
end

B1 --> Process
B2 --> Process
B3 --> Process

C1 --> C2
C2 --> C3
C3 --> O11
C3 --> O21
C3 --> O31

O11 --> O12 --> O13
O21 --> O22 --> O23
O31 --> O32 --> O33

subgraph Output
    Splunk
    Syslog
    H["ClickHouse"]
    Postgres
    Kafka
    I["JSON File"]
    Influx
    Elastic
    J["stdout"]
    Parquet
    Sentinel
end

O13 --> H
O23 --> I
O33 --> J

# Caratteristiche principali

- Capacità di utilizzare `afpacket` di Linux e la cattura dei pacchetti a copia zero.
- Supporta BPF
- Capacità di mascherare l'indirizzo IP per migliorare la privacy
- Capacità di avere un rapporto di campionamento pre-elaborazione
- Capacità di avere una lista di `fqdn` da "saltare" per evitare di scrivere alcuni domini/suffissi/prefissi nell'archivio
- Capacità di avere una lista di domini "consentiti", utilizzata per registrare l'accesso a determinati domini
- Ricarica a caldo dei file/URL dei domini da saltare e consentiti
- Output modulare con logica configurabile per flusso di output.
- Politica di conservazione automatica dei dati utilizzando l'attributo TTL di ClickHouse
- Dashboard Grafana integrata per l'output ClickHouse.
- Capacità di essere distribuito come un singolo binario collegato staticamente
- Capacità di essere configurato tramite variabili d'ambiente, opzioni da riga di comando o file di configurazione
- Capacità di campionare gli output utilizzando la funzionalità SAMPLE di ClickHouse
- Capacità di inviare metriche utilizzando `prometheus` e `statstd`
- Alto rapporto di compressione grazie all'archiviazione LZ4 integrata di ClickHouse
- Supporta DNS su TCP, DNS frammentato (udp/tcp) e IPv6
- Supporta [dnstap](https://github.com/dnstap/golang-dnstap) su socket Unix o TCP
- Integrazione SIEM integrata con Splunk e Microsoft Sentinel

# Installazione

## Linux

Il modo migliore per iniziare con `dnsmonster` è scaricare il binario dalla sezione release. Il binario è compilato staticamente con `musl`, quindi dovrebbe funzionare subito su molte distribuzioni. Per il supporto `afpacket`, è necessario utilizzare il kernel 3.x+. Qualsiasi distribuzione Linux moderna (CentOS/RHEL 7+, Ubuntu 14.0.4.2+, Debian 7+) è fornita con una versione 3.x+, quindi dovrebbe funzionare subito. Se la tua distribuzione non funziona con la versione precompilata, per favore invia un problema con i dettagli e compila `dnsmonster` manualmente usando questa sezione [Compila manualmente](#build-manually).

### Container

Poiché `dnsmonster` utilizza la funzionalità di cattura raw dei pacchetti, il demone Docker/Podman deve concedere la capacità al contenitore```
sudo docker run --rm -it --net=host --cap-add NET_RAW --cap-add NET_ADMIN --name dnsmonster ghcr.io/mosajjal/dnsmonster:latest --devName lo --stdoutOutputType=1

- senza `libpcap`:
`dnsmonster` utilizza solo una funzione da `libpcap`, e cioè convertire i filtri in stile `tcpdump` in bytecode BPF. Se puoi vivere senza il supporto BPF, puoi compilare `dnsmonster` senza `libpcap`. Nota che per qualsiasi altra piattaforma, la cattura dei pacchetti ricade su `libpcap` quindi diventa una dipendenza rigida (*BSD, Windows, Darwin)```sh
git clone https://github.com/mosajjal/dnsmonster --depth 1 /tmp/dnsmonster 
cd /tmp/dnsmonster
go get
go build -o dnsmonster -tags nolibpcap ./cmd/dnsmonster

Per maggiori informazioni su come viene creato il binario collegato staticamente, dai un'occhiata a [questo](https://github.com/fenkohq/dnsmonster/blob/main/Dockerfile) Dockerfile.

## Windows

La compilazione su Windows è molto simile a quella su Linux. Assicurati solo di avere `npcap`. Clona il repository (`--history 1` funziona) ed esegui `go get` e `go build ./cmd/dnsmonster`

Come accennato, la versione Windows del binario dipende dall'installazione di [npcap](https://nmap.org/npcap/#download). Dopo l'installazione, il binario dovrebbe funzionare out of the box. È stato testato in un ambiente Windows 10 e ha funzionato senza problemi. Per trovare i nomi delle interfacce da dare al parametro `--devName` e iniziare lo sniffing, dovrai fare quanto segue:

  - apri cmd.exe come Amministratore ed esegui il seguente comando: `getmac.exe`, vedrai una tabella con gli indirizzi MAC delle tue interfacce e una colonna Transport Name con qualcosa del tipo: `\Device\Tcpip_{16000000-0000-0000-0000-145C4638064C}`
  - esegui `dnsmonster.exe` in `cmd.exe` in questo modo:```sh
dnsmonster.exe --devName \Device\NPF_{16000000-0000-0000-0000-145C4638064C}

# Architettura

## Installazione All-in-one con Docker

![Diagramma AIO Base](https://raw.githubusercontent.com/fenkohq/dnsmonster/HEAD/static/dnsmonster-basic.svg)

Nel diagramma di esempio, il traffico di uscita/ingresso del server DNS viene catturato, dopodiché viene aggiunto un livello opzionale di aggregazione dei pacchetti prima di raggiungere il server DNSMonster. I dati in uscita dai server DNS sono molto utili per eseguire analisi della cache e delle prestazioni sulla flotta DNS. Se non hai un aggregatore a disposizione, puoi collegare entrambi i TAP direttamente a DNSMonster e avere due agenti DNSMonster che osservano il traffico.

eseguendo `./autobuild.sh` vengono creati più contenitori:

* più istanze di `dnsmonster` per osservare il traffico su qualsiasi interfaccia. L'elenco delle interfacce verrà richiesto come parte di `autobuild.sh`
* un'istanza di `clickhouse` per raccogliere l'output di `dnsmonster` e salvare tutti i log/dati in una directory di dati e log. Entrambi verranno richiesti come parte di `autobuild.sh`
* un'istanza di `grafana` che osserva i dati di `clickhouse` con dashboard predefinita.

### Demo All-in-one

[![Demo AIO](https://raw.githubusercontent.com/fenkohq/dnsmonster/HEAD/static/aio_demo.svg)](static/aio_demo.svg)

## Distribuzione Enterprise

![Diagramma AIO Base](https://raw.githubusercontent.com/fenkohq/dnsmonster/HEAD/static/dnsmonster-enterprise.svg)

# Configurazione

DNSMonster può essere configurato utilizzando 3 metodi diversi. Opzioni da riga di comando, variabili d'ambiente e file di configurazione. Ordine di precedenza:

- Opzioni da riga di comando (senza distinzione maiuscole/minuscole)
- Variabili d'ambiente (sempre maiuscole)
- File di configurazione (distinzione maiuscole/minuscole, minuscole)
- Valori predefiniti (nessuna configurazione)

## Opzioni da riga di comando

Nota: gli argomenti da riga di comando non fanno distinzione tra maiuscole e minuscole a partire da v0.9.5

[//]: <> (start of command line options)```sh
# [capture]
# Device used to capture
--devname=

# Pcap filename to run
--pcapfile=

# dnstap socket path. Example: unix:///tmp/dnstap.sock, tcp://127.0.0.1:8080
--dnstapsocket=

# Port selected to filter packets
--port=53

# Capture Sampling by a:b. eg sampleRatio of 1:100 will process 1 percent of the incoming packets
--sampleratio=1:1

# Cleans up packet hash table used for deduplication
--dedupcleanupinterval=1m0s

# Set the dnstap socket permission, only applicable when unix:// is used
--dnstappermission=755

# Number of routines used to handle received packets
--packethandlercount=2

# Size of the tcp assembler
--tcpassemblychannelsize=10000

# Size of the tcp result channel
--tcpresultchannelsize=10000

# Number of routines used to handle tcp packets
--tcphandlercount=1

# Size of the channel to send packets to be defragged
--defraggerchannelsize=10000

# Size of the channel where the defragged packets are returned
--defraggerchannelreturnsize=10000

# Size of the packet handler channel
--packetchannelsize=1000

# Afpacket Buffersize in MB
--afpacketbuffersizemb=64

# BPF filter applied to the packet stream. If port is selected, the packets will not be defragged.
--filter=((ip and (ip[9] == 6 or ip[9] == 17)) or (ip6 and (ip6[6] == 17 or ip6[6] == 6 or ip6[6] == 44)))

# Use AFPacket for live captures. Supported on Linux 3.0+ only
--useafpacket

# The PCAP capture does not contain ethernet frames
--noetherframe

# Deduplicate incoming packets, Only supported with --devName and --pcapFile. Experimental 
--dedup

# Do not put the interface in promiscuous mode
--nopromiscuous

# [clickhouse_output]
# Address of the clickhouse database to save the results. multiple values can be provided.
--clickhouseaddress=localhost:9000

# Username to connect to the clickhouse database
--clickhouseusername=

# Password to connect to the clickhouse database
--clickhousepassword=

# Database to connect to the clickhouse database
--clickhousedatabase=default

# Table which data will be stored on clickhouse database
--clickhousetable=DNS_LOG

# Interval between sending results to ClickHouse. If non-0, Batch size is ignored and batch delay is used
--clickhousedelay=0s

# Clickhouse connection LZ4 compression level, 0 means no compression
--clickhousecompress=0

# Debug Clickhouse connection
--clickhousedebug

# Use TLS for Clickhouse connection
--clickhousesecure

# Save full packet query and response in JSON format.
--clickhousesavefullquery

# Use DNSTap identity field instead of ServerName for the identity field in ClickHouse
--clickhouseusednstapidentity

# What should be written to clickhouse. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--clickhouseoutputtype=0

# Minimum capacity of the cache array used to send data to clickhouse. Set close to the queries per second received to prevent allocations
--clickhousebatchsize=100000

# Number of Clickhouse output Workers
--clickhouseworkers=1

# Channel Size for each Clickhouse Worker
--clickhouseworkerchannelsize=100000

# [elastic_output]
# What should be written to elastic. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--elasticoutputtype=0

# elastic endpoint address, example: http://127.0.0.1:9200. Used if elasticOutputType is not none
--elasticoutputendpoint=

# elastic index
--elasticoutputindex=default

# Send data to Elastic in batch sizes
--elasticbatchsize=1000

# Interval between sending results to Elastic if Batch size is not filled
--elasticbatchdelay=1s

# [file_output]
# What should be written to file. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--fileoutputtype=0

# Path to output folder. Used if fileoutputType is not none
--fileoutputpath=

# Interval to rotate the file in cron format
--fileoutputrotatecron=0 0 * * *

# Number of files to keep. 0 to disable rotation
--fileoutputrotatecount=4

# Output format for file. options:json, csv, csv_no_header, gotemplate. note that the csv splits the datetime format into multiple fields
--fileoutputformat=json

# Go Template to format the output as needed
--fileoutputgotemplate={{.}}

# [influx_output]
# What should be written to influx. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--influxoutputtype=0

# influx Server address, example: http://localhost:8086. Used if influxOutputType is not none
--influxoutputserver=

# Influx Server Auth Token
--influxoutputtoken=dnsmonster

# Influx Server Bucket
--influxoutputbucket=dnsmonster

# Influx Server Org
--influxoutputorg=dnsmonster

# Minimum capacity of the cache array used to send data to Influx
--influxoutputworkers=8

# Minimum capacity of the cache array used to send data to Influx
--influxbatchsize=1000

# [kafka_output]
# What should be written to kafka. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--kafkaoutputtype=0

# kafka broker address(es), example: 127.0.0.1:9092. Used if kafkaOutputType is not none
--kafkaoutputbroker=

# Kafka topic for logging
--kafkaoutputtopic=dnsmonster

# Minimum capacity of the cache array used to send data to Kafka
--kafkabatchsize=1000

# Output format. options:json, gob. 
--kafkaoutputformat=json

# Kafka connection timeout in seconds
--kafkatimeout=3

# Interval between sending results to Kafka if Batch size is not filled
--kafkabatchdelay=1s

# Compress Kafka connection
--kafkacompress

# Compression Type Kafka connection [snappy gzip lz4 zstd]; default(snappy).
--kafkacompressiontype=snappy

# Use TLS for kafka connection
--kafkasecure

# Path of CA certificate that signs Kafka broker certificate
--kafkacacertificatepath=

# Path of TLS certificate to present to broker
--kafkatlscertificatepath=

# Path of TLS certificate key
--kafkatlskeypath=

# [parquet_output]
# What should be written to parquet file. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--parquetoutputtype=0

# Path to output folder. Used if parquetoutputtype is not none
--parquetoutputpath=

# Number of records to write to parquet file before flushing
--parquetflushbatchsize=10000

# Number of workers to write to parquet file
--parquetworkercount=4

# Size of the write buffer in bytes
--parquetwritebuffersize=256000

# [psql_output]
# What should be written to Microsoft Psql. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--psqloutputtype=0

# Psql endpoint used. must be in uri format. example: postgres://username:password@hostname:port/database?sslmode=disable
--psqlendpoint=

# Psql table which data will be stored on database
--psqltable=DNS_LOG

# Number of PSQL workers
--psqlworkers=1

# Psql Batch Size
--psqlbatchsize=1

# Interval between sending results to Psql if Batch size is not filled. Any value larger than zero takes precedence over Batch Size
--psqlbatchdelay=0s

# Timeout for any INSERT operation before we consider them failed
--psqlbatchtimeout=5s

# Save full packet query and response in JSON format.
--psqlsavefullquery

# [sentinel_output]
# What should be written to Microsoft Sentinel. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--sentineloutputtype=0

# Sentinel Shared Key, either the primary or secondary, can be found in Agents Management page under Log Analytics workspace
--sentineloutputsharedkey=

# Sentinel Customer Id. can be found in Agents Management page under Log Analytics workspace
--sentineloutputcustomerid=

# Sentinel Output LogType
--sentineloutputlogtype=dnsmonster

# Sentinel Output Proxy in URI format
--sentineloutputproxy=

# Sentinel Batch Size
--sentinelbatchsize=100

# Interval between sending results to Sentinel if Batch size is not filled. Any value larger than zero takes precedence over Batch Size
--sentinelbatchdelay=0s

# [splunk_output]
# What should be written to HEC. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--splunkoutputtype=0

# splunk endpoint address, example: http://127.0.0.1:8088. Used if splunkOutputType is not none, can be specified multiple times for load balanace and HA
--splunkoutputendpoint=

# Splunk HEC Token
--splunkoutputtoken=00000000-0000-0000-0000-000000000000

# Splunk Output Index
--splunkoutputindex=temp

# Splunk Output Proxy in URI format
--splunkoutputproxy=

# Splunk Output Source
--splunkoutputsource=dnsmonster

# Splunk Output Sourcetype
--splunkoutputsourcetype=json

# Send data to HEC in batch sizes
--splunkbatchsize=1000

# Interval between sending results to HEC if Batch size is not filled
--splunkbatchdelay=1s

# [stdout_output]
# What should be written to stdout. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--stdoutoutputtype=0

# Output format for stdout. options:json,csv, csv_no_header, gotemplate. note that the csv splits the datetime format into multiple fields
--stdoutoutputformat=json

# Go Template to format the output as needed
--stdoutoutputgotemplate={{.}}

# Number of workers
--stdoutoutputworkercount=8

# [syslog_output]
# What should be written to Syslog server. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--syslogoutputtype=0

# Syslog endpoint address, example: udp://127.0.0.1:514, tcp://127.0.0.1:514. Used if syslogOutputType is not none
--syslogoutputendpoint=udp://127.0.0.1:514

# [victoria_output]
# Victoria Output Endpoint. example: http://localhost:9428/insert/jsonline?_msg_field=rcode_id&_time_field=time
--victoriaoutputendpoint=

# What should be written to Microsoft Victoria. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--victoriaoutputtype=0

# Victoria Output Proxy in URI format
--victoriaoutputproxy=

# Number of workers
--victoriaoutputworkers=8

# Victoria Batch Size
--victoriabatchsize=100

# Interval between sending results to Victoria if Batch size is not filled. Any value larger than zero takes precedence over Batch Size
--victoriabatchdelay=0s

# [zinc_output]
# What should be written to zinc. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--zincoutputtype=0

# index used to save data in Zinc
--zincoutputindex=dnsmonster

# zinc endpoint address, example: http://127.0.0.1:9200/api/default/_bulk. Used if zincOutputType is not none
--zincoutputendpoint=

# zinc username, example: [email protected]. Used if zincOutputType is not none
--zincoutputusername=

# zinc password, example: password. Used if zincOutputType is not none
--zincoutputpassword=

# Send data to Zinc in batch sizes
--zincbatchsize=1000

# Interval between sending results to Zinc if Batch size is not filled
--zincbatchdelay=1s

# Zing request timeout
--zinctimeout=10s

# [general]
# Garbage Collection interval for tcp assembly and ip defragmentation
--gctime=10s

# Duration to calculate interface stats
--capturestatsdelay=1s

# Mask IPv4s by bits. 32 means all the bits of IP is saved in DB
--masksize4=32

# Mask IPv6s by bits. 32 means all the bits of IP is saved in DB
--masksize6=128

# Name of the server used to index the metrics.
--servername=default

# Set debug Log format
--logformat=text

# Set debug Log level, 0:PANIC, 1:ERROR, 2:WARN, 3:INFO, 4:DEBUG
--loglevel=3

# Size of the result processor channel size
--resultchannelsize=100000

# write cpu profile to file
--cpuprofile=

# write memory profile to file
--memprofile=

# GOMAXPROCS variable
--gomaxprocs=-1

# Limit of packets logged to clickhouse every iteration. Default 0 (disabled)
--packetlimit=0

# Skip outputing domains matching items in the CSV file path. Can accept a URL (http:// or https://) or path
--skipdomainsfile=

# Hot-Reload skipdomainsfile interval
--skipdomainsrefreshinterval=1m0s

# Allow Domains logic input file. Can accept a URL (http:// or https://) or path
--allowdomainsfile=

# Hot-Reload allowdomainsfile file interval
--allowdomainsrefreshinterval=1m0s

# Skip TLS verification when making HTTPS connections
--skiptlsverification

# [metric]
# Metric Endpoint Service
--metricendpointtype=

# Statsd endpoint. Example: 127.0.0.1:8125 
--metricstatsdagent=

# Prometheus Registry endpoint. Example: http://0.0.0.0:2112/metric
--metricprometheusendpoint=

# Format for  output.
--metricformat=json

# Interval between sending results to Metric Endpoint
--metricflushinterval=10s

## File di configurazione
puoi eseguire `dnsmonster` usando il seguente comando per utilizzare il file di configurazione:```shell
$ sudo dnsmonster --config=dnsmonster.ini

# Or you can use environment variables to set the configuration file path
$ export DNSMONSTER_CONFIG=dnsmonster.ini
$ sudo -E dnsmonster

NOTE: Il comando sopra modifica solo il TTL per i dati grezzi del log DNS, che costituiscono la maggior parte del consumo di capacità. Per assicurarti di regolare il TTL per ogni singola tabella di aggregazione, puoi eseguire il seguente:```sql
ALTER TABLE DNS_LOG MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_DOMAIN_COUNT` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_DOMAIN_UNIQUE` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_PROTOCOL` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_GENERAL_AGGREGATIONS` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_EDNS` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_OPCODE` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_TYPE` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_CLASS` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_RESPONSECODE` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_SRCIP_MASK` MODIFY TTL DnsDate + INTERVAL 90 DAY;